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DETAILED ACTION 

1 . A request for continued examination under 37 CFR 1.114, including the fee set 
fortli in 37 CFR 1 .17(e), was filed in this application after allowance or after an Office 
action under Ex Parte Quayle, 25 USPQ 74, 453 O.G. 213 (Comm'r Pat. 1935). Since 
this application is eligible for continued examination under 37 CFR 1.114, and the fee 
set forth in 37 CFR 1.17(e) has been timely paid, prosecution in this application has 
been reopened pursuant to 37 CFR 1.114. Applicant's submission filed on August 17, 
2006 and the Supplemental Amendment filed on September 6, 2006 has been entered. 
Claims 1 , 9, 16, 23, 27, 28, 29 and 30 were previously been amended. Claims 4-5 and 
19-20 were previously canceled. Claims 9-15, 23-26 and 30 are canceled. Claims 31- 
35 are newly added. Claims 1 -3, 6-8, 16-18, 21 , 22, 27-29, and 31 -35 are pending. 

Allowable Subject Matter 

2. Claims 1-3, 6-8. 16-18, 21 , 22, 27-29 and 31-35 are allowed. 

The following is an examiner's statement of reasons for allowance: 
The current invention is directed to method and system for a policy-based 
network security management system. Applicant's claimed invention includes features 
of creating and storing a risk level of a user, where the risk level is a discrete value 
representing a long term measurement of the likelihood of the user harming the network 
and creating and storing a current alert level where the current alert level is a discrete 
value representing a current measurement of the likelihood of the user negatively 
affecting the network and automatically deciding on a course of action based on the risk 
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level and the current alert level. The closest prior art, Proctor, teaches activities are 
monitored to determine whether established threshold level have been met or exceed, 
whether the activities are occunring out of nomnal ranges, once this security occurrence 
is detected, notification is provided to response service to determine what corrective 
action is necessary and instructs one or more of the policy editors to update the 
policies. In Proctor, security occurrence are stored in log files and auditing events 
specified in an audit policy, collecting records according to a collection policy and 
performing security analysis based on the records collected from the audit logs and 
updating the policies depending on the results from the security analysis. Protor does 
not teach the monitored activities is based on two separate and discret values that 
represent risk level and current alert level and measuring the risk level according to long 
term likelihood of user harming the network and current measurement of the likelihood 
of the user negatively affecting the network and automatically deciding on a course of 
action based on these two discrete values. Neither the art of record, singularly or in 
combination, anticipates or render the claimed limitation obvious. 

Any comments considered necessary by applicant must be submitted no later 
than the payment of the issue fee and, to avoid processing delays, should preferably 
accompany the issue fee. Such submissions should be clearly labeled "Comments on 
Statement of Reasons for Allowance." 
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3. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Tongoc Iran whose telephone number is (571 ) 272- 
3843. The examiner can normally be reached on 8:30-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Jacques Louis-Jacques can be reached on (571) 272-3962. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 



Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications Is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



273-8300. 
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